CVE-2026-114112

About vulnerability

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

Affected product:

Next.js , React , Vue , appium , appium-base-driver , appium-base-plugin , appium-opencv , appium-support , arcjet-js , astro , astro-expressive-code , astrojs-cloudflare , astrojs-markdoc , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-svelte , astrojs-tailwind , astrojs-vercel , astrojs-vue , babel-plugin-remove-graphql-queries , builder.io-qwik-city , clerk-astro , docusaurus , elements , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-manifest , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-sharp , gatsby-source-contentful , gatsby-source-filesystem , gatsby-source-wordpress , gatsby-transformer-sqip , huggingface-transformers , imagetools , img-sharp-darwin-arm64 , img-sharp-darwin-x64 , img-sharp-linux-arm , img-sharp-linux-arm64 , img-sharp-linux-ppc64 , img-sharp-linux-riscv64 , img-sharp-linux-s390x , img-sharp-linux-x64 , img-sharp-win32-arm64 , img-sharp-win32-ia32 , img-sharp-win32-x64 , ipx , lancedb , livekit-agents-plugin-livekit , livestore-utils-dev , lucide-astro , mastra , mastra-lance , miniflare , modern-js-image , netlify-dev , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , npm:gatsby-theme-blog-core , panda , qwik , remotion-video-matting , remotion-whisper-webgpu , responsive-loader , rsbuild-image , scalar-astro , scalar-starlight , sentry-gatsby , sharp , storybook-experimental-nextjs-vite , storybook-nextjs , strapi-strapi , strapi-upload , theme-ui , workers-sdk , zephyr-astro-integration

Affected packages:

sharp @ 0.32.6 (+1180 more)